System and method to monitor network delay

Abstract

A method of monitoring a network is provided that includes receiving a stream of samples having respective network delay values; defining at least one first group of samples having a size defined by a window size; determining respective first network delay characteristics for the first groups based on the network delay values corresponding to the respective samples included in the corresponding group; applying a first test to the first network delay characteristic determined for the respective first groups; adjusting the window size based on a result of the first test associated with the respective first groups; using the adjusted window size, define respective second groups of samples having samples of the stream of samples subsequent to the samples included in the at least one first group; determining a second network delay characteristic for the respective second groups; applying a second test to the second network delay characteristics; and determining whether to generate an alert notification based on a result of at least one of the first and second tests.

The invention claimed is: 
     
       1. A method of monitoring a network comprising operations to:
 A. receive a stream of samples, each sample having an associated network delay value that indicates an amount of time data packets associated with the sample are delayed when transmitted between first network device and second network devices coupled to a network; 
 B. define at least one first group of samples that correspond to a network delay measured on a communication link within a certain time interval, the number of samples included in each group being defined by a window size; 
 C. determine a first network delay characteristic for the respective first groups, each network delay characteristic being based on the network delay values corresponding to the respective samples included in the corresponding group; 
 D. apply a first test to the first network delay characteristic determined for the respective first groups; 
 E. adjust the window size based on a result of the first test associated with the respective first groups; 
 F. using the adjusted window size, define at least one second group of samples that correspond to a network delay measured on a communication link within a certain time interval, each second group including samples of the stream of samples subsequent to the samples included in the at least one first group; 
 G. determine a second network delay characteristic for the respective second groups; 
 H. apply a second test to the second network delay characteristic determined for the respective second groups; and 
 I. determine whether to generate an alert notification based on a result of at least one of the first and second tests. 
 
     
     
       2. The method of  claim 1 , wherein the method further comprises repeating operations E-I, replacing first test associated with the respective first groups with the second test associated with the respective second groups, and defining a new set of at least one second group of samples that include samples of the stream of samples subsequent to the samples included in the at least one second group. 
     
     
       3. The method of  claim 1 , wherein the determination whether to generate an alert notification is based on the result of the first and second tests. 
     
     
       4. The method of  claim 1 , wherein the network delay value associated with each sample of the stream of samples is based on a characteristic of data packets transmitted between network devices of the network during an associated time period having a predetermined length. 
     
     
       5. The network monitoring system of  claim 1 , wherein each network delay characteristic is an average value of the network delay values associated with the samples included in the corresponding group. 
     
     
       6. The network monitoring system of  claim 1 , wherein the first test includes determining whether the first network delay characteristic associated with the corresponding group is below a predetermined threshold value, and the window size is decreased in response to a negative determination. 
     
     
       7. The network monitoring system of  claim 1 , wherein the first test includes determining whether the first network delay characteristic associated with the corresponding group is below a predetermined threshold value, and the window size is increased in response to a positive determination. 
     
     
       8. A non-transitory computer readable storage medium and one or more computer programs embedded therein, the computer programs comprising instructions, which when executed by a computer system, cause a computer system to:
 A. receive a stream of samples, each sample having an associated network delay value that indicates an amount of time data packets associated with the sample are delayed when transmitted between first network device and second network devices coupled to a network; 
 B. define at least one first group of samples that correspond to a network delay measured on a communication link within a certain time interval, the number of samples included in each group being defined by a window size; 
 C. determine a first network delay characteristic for the respective first groups, each network delay characteristic being based on the network delay values corresponding to the respective samples included in the corresponding group; 
 D. apply a first test to the first network delay characteristic determined for the respective first groups; 
 E. adjust the window size based on a result of the first test associated with the respective first groups; 
 F. using the adjusted window size, define at least one second group of samples that correspond to a network delay measured on a communication link within a certain time interval, each second group including samples of the stream of samples subsequent to the samples included in the at least one first group; 
 G. determine a second network delay characteristic for the respective second groups; 
 H. apply a second test to the second network delay characteristic determined for the respective second groups; and 
 I. determine whether to generate an alert notification based on a result of at least one of the first and second tests. 
 
     
     
       9. The non-transitory computer readable storage medium of  claim 8 , wherein the instructions, when executed by a computer system, cause a computer system to repeat operations E-I, replacing first test associated with the respective first groups with the second test associated with the respective second groups, and defining a new set of at least one second group of samples that include samples of the stream of samples subsequent to the samples included in the at least one second group. 
     
     
       10. The non-transitory computer readable storage medium of  claim 8 , wherein the determination whether to generate an alert notification is based on the result of the first and second tests. 
     
     
       11. The non-transitory computer readable storage medium of  claim 8 , wherein the network delay value associated with each sample of the stream of samples is based on a characteristic of data packets transmitted between network devices of the network during an associated time period having a predetermined length. 
     
     
       12. The non-transitory computer readable storage medium of  claim 8 , wherein the first test includes determining whether the first network delay characteristic associated with the corresponding group is below a predetermined threshold value, and the window size is decreased in response to a negative determination. 
     
     
       13. The non-transitory computer readable storage medium of  claim 8 , wherein the first test includes determining whether the first network delay characteristic associated with the corresponding group is below a predetermined threshold value, and the window size is increased in response to a positive determination.